ACTi ACM-5611 Video Camera Remote Command Execution

!/usr/bin/perl ACTi ACM-5611 Video Camera Remote Command Execution Exploit Copyright 2019 c Todor Donev Firmware Version = A1D-220-V3.08.08-AC Production ID = ACM5611-08G-X-00485 Factory Default Type = NTSC, Composite, Two Ways Audio 0x71 Company Name = ACTi Corporation WEB Site = www.acti.com...

CVE-2019-16706

kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cmsuseradd.php...

CISA Releases Four New Insights Products

The Cybersecurity and Infrastructure Security Agency CISA has released four new CISA Insights products informed by U.S. intelligence and real-world events. Each of the following products provides a description of the threat, lessons learned, recommendations, and additional relevant resources:...

no.thegraduatejob.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-976014 Security Researcher 0xrocky Helped patch 1796 vulnerabilities Received 7 Coordinated Disclosure badges Received 5 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting no.thegraduatejob.com websit...

comboimoveis.com.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-975340 Security Researcher pacenoge Helped patch 399 vulnerabilities Received 3 Coordinated Disclosure badges Received 9 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting comboimoveis.com.br website...

razorblade.collector.free.fr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-974772 Security Researcher KhanJanny Helped patch 3055 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

ru.thepurchasingjob.com Cross Site Scripting vulnerability

Security Researcher garletmarco Helped patch 1540 vulnerabilities Received 4 Coordinated Disclosure badges , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting ru.thepurchasingjob.com website and its users. Following coordinated and responsib...

College-Management-System 1.2 - Authentication Bypass

Exploit Title: College-Management-System 1.2 - Authentication Bypass Author: Cakes Discovery Date: 2019-09-14 Vendor Homepage: https://github.com/ajinkyabodade/College-Management-System Software Link: https://github.com/ajinkyabodade/College-Management-System/archive/master.zip Tested Version: 1....

WebARX — A Defensive Core For Your Website

Estonian based web security startup WebARX, the company who is also behind open-source plugin vulnerability scanner WPBullet and soon-to-be-released bug bounty platform plugbounty.com , has a big vision for a safer web. It built a defensive core for websites which is embedded deep inside the...

takajewellery.com.sg Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-960070 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Microsoft Lync CVE-2019-1209 Information Disclosure Vulnerability

Description Microsoft Lync is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Lync Server 2013 Recommendations Run all software as a nonprivileged user with minimal...

Microsoft Windows JET Database Engine CVE-2019-1246 Remote Code Execution Vulnerability

Description Microsoft Windows JET Database Engine is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of an affected system. Technologies Affected Microsoft Office 2010 32-bit edition SP2 Microsoft Office 2010 64-bit editi...

CVE-2019-16178

LimeSurvey prior to 3.17.14 is affected by a stored XSS vulnerability that allows authenticated users with appropriate permissions to inject arbitrary script or HTML via the titles of admin box buttons on the home page. Root cause is input in button titles not properly sanitized before rendering....

CVE-2019-12463

CVE-2019-12463 affects LibreNMS 1.50.1. The vulnerability exists in the graphing code paths (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php) where user input is insufficiently validated/encoded. Some parameters are filtered with mysqli_real_escape_string, others are u...

dobovo.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-959204 Security Researcher geeknik Helped patch 8834 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting dobovo.com website and its...

Online Appointment - SQL Injection

Online Appointment - SQL Injection Exploit Title: Online Appointment SQL Injection Data: 07.09.2019 Exploit Author: mohammad zaheri Vendor HomagePage: https://github.com/girish03/Online-Appointment-Booking-System Tested on: Windows Google Dork: N/A ========= Vulnerable Page: =========...

smiledirectclub.co.uk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-958947 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting smiledirectclub.co.uk websi...

lusk.cz Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-958640 Security Researcher KhanJanny Helped patch 3065 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting lusk.cz website and its...

Reality < 2.4.0 - Multiple Persistent XSS

----- Persistent XSS on any property page: ----- Vulnerable input fields: 1 - Description & Price - 'PRICE POSTFIX TEXT' and 'SECOND PRICE POSTFIX TEXT'; 2 - Additional Information - 'TITLE' and 'VALUE'; 3 - Location & Map - 'ADDRESS '. Payload Sample: ----- Persistent XSS on user profile page:...

Inventory Webapp - 'itemquery' SQL injection

Exploit Title: Inventory Webapp SQL injection Data: 05.09.2019 Exploit Author: mohammad zaheri Vendor HomagePage: https://github.com/edlangley/inventory-webapp Tested on: Windows Google Dork: N/A ========= Vulnerable Page: ========= /php/add-item.php ========== Vulnerable Source: ========== Line3...